Probes PHP for the php2shell multipart crash bug
php2shell probes a site for weaknesses, so it only runs on domains your organization has proven it owns, by email, a DNS record or a file on the site. That keeps it from being pointed at someone else's site.
Control request — sends a minimal, well-formed multipart POST to the audited URL and records how the server answers (and whether it is phpMyAdmin, which the scanner retargets).
Probes — sends up to three crafted multipart bodies designed to trip the parser, stopping early as soon as it has a verdict.
Crash detection — looks for an in-band PHP fatal error, an empty 500/200 body where the control produced output, or a 502/503/504 from the server fronting PHP-FPM.
Version fallback — when no crash is observed, reads the X-Powered-By banner and compares it with the fixed releases.
Verdict — the scanner returns one verdict (VULNERABLE, FIXED, NO SIGNAL, INCONCLUSIVE or ERROR), which this auditor maps to a single result.
| Key | Type | Default | Description |
|---|---|---|---|
sapi | string | auto | Which verdict rules to use: auto, mod_php or fpm. auto lets the scanner infer the server mode; set mod_php or fpm when you know it to sharpen the crash signal. An invalid value falls back to auto. |
timeoutSeconds | integer | 20 | Per-request timeout for the scanner, 5–120. The scan sends a control request plus up to three probes in sequence, so keep it well under two minutes. An out-of-range or invalid value falls back to 20. |
Whether the PHP request handler can be crashed by a crafted multipart/form-data body (the core of CVE-2026-109618 / CVE-2026-109619).
The advertised PHP version, as a fallback, when the probes produce no crash signal: a patched release passes, an unpatched one fails.
It inspects only the audited page for a block (HTTP 403 / 429 / Cloudflare challenge); the probes are part of the audited request, not separate paths.
Every row maps to one checkRule* method and one CheckCode. CheckCode suffixes use status ranges: 100 information, 200–299 success, 300–399 warning, 400–499 fail, 500–599 error.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
|---|---|---|---|---|
37A-Php2ShellAuditor-100 | INFORMATION | Always. Records the CVEs and the fixed PHP versions this auditor probes for. | — (recommendation is null; nothing for the site to change) | — |
37A-Php2ShellAuditor-200 | SUCCESS | Verdict FIXED: no crash observed and X-Powered-By reports a patched PHP release. | — | — |
37A-Php2ShellAuditor-201 | SUCCESS | Verdict NO SIGNAL: no crash observed; the server advertises no PHP version, but nothing indicates a vulnerability. | — | — |
37A-Php2ShellAuditor-300 | WARNING | Verdict INCONCLUSIVE: the control request returned HTTP 5xx, or a probe was rejected before PHP parsed it, so no firm verdict was reached. | Re-run the audit; if a WAF or proxy rejected the probe, test the PHP origin directly so its patch level for CVE-2026-109618 / CVE-2026-109619 can be confirmed. | An inconclusive probe leaves the CVE status unknown, so the server may still be exposed to the crash; treat it as unverified rather than safe and re-run or test the origin directly. |
37A-Php2ShellAuditor-400 | FAIL | Verdict VULNERABLE: a probe crashed the PHP request handler, or the advertised PHP version is unpatched. | Upgrade PHP on {host} to a fixed release for your branch (PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12) and restart PHP-FPM or Apache. | An unauthenticated request can crash the PHP worker handling it, so a handful of requests take the site down (denial of service), and the memory corruption behind the crash can open the door to worse. |
37A-Php2ShellAuditor-500 | ERROR | Verdict ERROR: the scan could not run against the target (could not connect, resolve or normalize the URL). | Make {url} reachable over HTTP(S) and re-run the audit. | — |
37A-Php2ShellAuditor-590 | ERROR | The audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page. | Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See https://www.37audits.com/bot. | While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported. |
| Status | Description | Test logic |
|---|---|---|
| SUCCESS | Not affected | No crash and a patched X-Powered-By (200), or no crash and no version signal (201). |
| WARNING | Could not confirm | The scan was inconclusive — control HTTP 5xx, or a probe rejected before PHP parsed it (300). |
| FAIL | Vulnerable | A probe crashed the request handler, or the advertised PHP version is unpatched (400). |
| ERROR | The auditor could not check | The scan could not run against the target (500); the site blocked 37AuditsBot (590). |
| INFORMATION | Reference | The CVEs and fixed PHP versions this auditor probes for (100); never changes the result. |
The probes are the actual exploit payloads: on a vulnerable server they crash the PHP worker handling the request. Only run this against sites you own or are authorized to test — which is why it is gated on domain verification and is off for anonymous previews.
NO SIGNAL means the probes did not crash the server and no PHP version was advertised. It is reported as a pass, but it is not proof of safety: confirm the running PHP version is at least the fixed release.
INCONCLUSIVE means a WAF, proxy or server error stopped the scan from reaching a verdict. The server may still be exposed — re-run, or test the PHP origin directly.
This auditor wraps Assetnote's php2shell-scanner and infers the verdict from the server's responses, so a result can be wrong in either direction: a WAF, proxy or load balancer can absorb a crash and look like a pass, and an unrelated 5xx can look like a crash. Before you act on a FAIL — or rely on a SUCCESS — have a person confirm it against the host (check the running PHP version and the server logs for the probe requests).
The bug lets an unauthenticated request crash the PHP process, so a few requests can take a site down (denial of service).
The memory corruption behind the crash raises the risk of worse outcomes than a crash, so patching promptly matters.
This documentation is built and hosted on Mintlify, a developer documentation platform.
Add this auditor to your monitoring setup and start identifying issues on your websites today.